3 ms·

That's all perfectly fair criticism about a specific type of OSS advocate. But the discussion here is not actually about "it's more secure because it's open" an

That's all perfectly fair criticism about a specific type of OSS advocate. But the discussion here is not actually about "it's more secure because it's open" and really about "it has a higher likely-hood of being secure because all of the code is fully audit-able" Again, heartbleed is a terrible example because many many people have complained for a long time about the cruft building around OpenSSL. Do you think i don't read the code of an open source python module before I roll it into a project? Would I ever consider including a python module in my code that came to me as a binary blob (not that this possible ... yet)? Not on your life. The reality is it's shitty that I have to trust corporations with closed source firmware and I wish it were otherwise.

scarface74 9y ago
it has a higher likely-hood of being secure because all of the code is fully audit-able If that's true, there should be a way that you can compare the amount of security vulnerabilities in iOS vs Android and the time it takes to get it patched and get the pst h distributed. It should also be possible to have the same metric in Windows vs Linux, the various open source databases vs the closed source databases etc. On the other hand there is an existence proof that closed source software doesn't prevent smart people from finding security vulnerabilities in closed source software - the number of vulnerabilities that researchers have found in iOS. But why is everyone acting as if reading assembly code is some sort of black magic that only a few anointed people can do? And if open source, easily readable code was such a panacea, the WordPress vulnerability of the week wouldnt exist.